Skip to content

Centralize testing key/cert constants in test/rubygems/pem_utilities.rb - #9768

Open
junaruga wants to merge 1 commit into
ruby:masterfrom
junaruga:wip/improve-key-cert-constant-management
Open

Centralize testing key/cert constants in test/rubygems/pem_utilities.rb#9768
junaruga wants to merge 1 commit into
ruby:masterfrom
junaruga:wip/improve-key-cert-constant-management

Conversation

@junaruga

@junaruga junaruga commented Aug 5, 2026

Copy link
Copy Markdown
Member

This commit refactors testing key/cert constants in a more consistent way.

The key/cert constants were duplicated across the files, and there was a
different constant naming *_PATH vs *_FILE.

Create test/rubygems/pem_utilities.rb moving .pem methods/constants from
test/rubygems/helper.rb to manage testing key/cert constants in one file.
test/rubygems/local_ssl_server_utilities.rb, used by both RubyGems and
Bundler, also uses these constants, so the new pem_utilities.rb must not
depend on test-unit.

In test/rubygems/pem_utilities.rb, added the following features compared to
test/rubygems/helper.rb.

  • Add pem_file method for combined cert+key PEM files
  • Rename helper methods from key_path to key_file, from cert_path to
    cert_file, to consistently use the *_FILE suffix for constants.
  • Align test/rubygems/*.pem file names and constants with the pattern
    <algorithm>_<name>. If the <algorithm> is RSA 2048 bits, there is no
    <algorithm>_ prefix as a default algorithm.
  • Rename EXPIRED_PUBLIC_CERT to EXPIRED_CERT. CERT is only public. There is no private
    cert file.
  • Update local_ssl_server_utilities.rb to use constants directly,
    removing unused methods.
  • Handle OpenSSL::PKey::PKeyError in load_key for unsupported
    algorithms on old OpenSSL versions

Assisted-by: Claude:claude-opus-4-6[1m]

What was the end-user or developer problem that led to this PR?

This PR is to refactor testing constant managements addressed on the #9697. In the current testing constants, it was not convenient to add more ML-DSA-65 tests in test/rubygems/test_gem_security*.rb with inconsistent constants such as _PATH vs _FILE, and duplicated constants across testing files, and inconsistent test/rubygems/*.pem file and constant naming patterns.

What is your fix for the problem, implemented in this PR?

This PR refactors testing key/cert constants in a more consistent way, managing constants in in one file, and aligning test/rubygems/*.pem file names and constants with the pattern <algorithm>_<name>, removing duplicated and unused methods/constants.

Make sure the following tasks are checked

@junaruga
junaruga force-pushed the wip/improve-key-cert-constant-management branch 2 times, most recently from 2a50ada to c9b16c5 Compare August 5, 2026 18:17
@junaruga
junaruga force-pushed the wip/improve-key-cert-constant-management branch from c9b16c5 to 1e96be8 Compare August 5, 2026 18:26
@junaruga

junaruga commented Aug 5, 2026

Copy link
Copy Markdown
Member Author

@hsbt Could you review this PR? This was found on for #9697, and this refactors the code. After this PR is merged, I can rebase #9697 on the latest master branch.

The Ubuntu ruby-4.0 CI case failed with a random internet error. I don't think this failure is related to this PR.
https://github.com/ruby/rubygems/actions/runs/31034718272/job/92404006797?pr=9768#step:12:117

@junaruga
junaruga force-pushed the wip/improve-key-cert-constant-management branch 2 times, most recently from 69a2ec4 to 8d4c209 Compare August 5, 2026 19:47
CHILD_KEY = load_key "child"
EC_KEY = load_key "private_ec", "Foo bar"

ALTERNATE_CERT = load_cert "child"

@junaruga junaruga Aug 5, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This line is mistake. The code was originally intended as below. However, it seemed that ALTERNATE_CERT was used as CHILD_CERT in one part. So, I replaced the one part ALTERNATE_CERT with CHILD_CERT.

ALTERNATE_CERT = load_cert "alternate"

This commit refactors testing key/cert constants in a more consistent way.

The key/cert constants were duplicated across the files, and there was a
different constant naming `*_PATH` vs `*_FILE`.

Create test/rubygems/pem_utilities.rb moving .pem methods/constants from
test/rubygems/helper.rb to manage testing key/cert constants in one file.
test/rubygems/local_ssl_server_utilities.rb, used by both RubyGems and
Bundler, also uses these constants, so the new pem_utilities.rb must not
depend on test-unit.

In test/rubygems/pem_utilities.rb, added the following features compared to
test/rubygems/helper.rb.

* Add pem_file method for combined cert+key PEM files
* Rename helper methods from key_path to key_file, from cert_path to
  cert_file, to consistently use the `*_FILE` suffix for constants.
* Align test/rubygems/*.pem file names and constants with the pattern
  `<algorithm>_<name>`. If the `<algorithm>` is RSA 2048 bits, there is no
  `<algorithm>_` prefix as a default algorithm.
* Rename `EXPIRED_PUBLIC_CERT` to `EXPIRED_CERT`. CERT is only public. There is
  no private cert file.
* Update local_ssl_server_utilities.rb to use constants directly,
  removing unused methods.
* Handle OpenSSL::PKey::PKeyError in load_key for unsupported
  algorithms on old OpenSSL versions

Assisted-by: Claude:claude-opus-4-6[1m]
@junaruga
junaruga force-pushed the wip/improve-key-cert-constant-management branch from 8d4c209 to 35d72d7 Compare August 5, 2026 20:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant